lkml.org 
[lkml]   [2014]   [Sep]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subject[RFC][PATCH 00/13] MODSIGN: Use PKCS#7 for module signatures
From
Date

Here's a set of patches that does the following:

(1) Improves asymmetric keys identification.

Keys derived from X.509 certs now get labelled with IDs derived from their
issuer and certificate number (required to match PKCS#7) and from their
SKID and subject (required to match X.509).

IDs are now binary and match criterion preparsing is provided so that
criteria can be turned into binary blobs to make matching faster.

(2) Improves PKCS#7 message handling to permit PKCS#7 messages without X.509
cert lists to be matched to trusted keys, thereby allowing minimally sized
PKCS#7 certs to be used.

(3) Improves PKCS#7 message handling to better handle certificate chains that
are broken due to unsupported crypto that can otherwise by used to
intersect a trust keyring.

(4) Makes use of the PKCS#7 facility to provide module signatures.

sign-file is replaced with a program that generates a PKCS#7 message that
has no X.509 certs embedded and that has detached data (the module
content) and adds it onto the message with magic string and descriptor.

(5) The PKCS#7 message (and matching X.509 cert) supply all the information
that is needed to select the X.509 cert to be used to verify the signature
by standard means (including selection of digest algorithm and public key
algorithm). No kernel-specific magic values are required.

The following need to be considered also:

(1) How to support externally generated signatures (sign-file -s). Ideally,
externally generated signatures would be provided as PKCS#7 certificates.

(2) How to handle the old signature format: do we change the magic number and
just pretend they don't exist (which would allow us to get rid of most of
the descriptor), do we give an error (which I've chosen to do) or do we
have to support them still?

(3) Do I really need to make one of the X.509-derived IDs out of the subjKeyId
and the subject, or can I just use the subjKeyId by itself? (And likewise
for auth + issuer)

They can be found here also:

http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=modsign-pkcs7

David
---
David Howells (13):
Provide a binary to hex conversion utility
KEYS: Preparse match data
KEYS: Remove key_type::def_lookup_type
KEYS: Remove key_type::match in favour of overriding default by match_preparse
KEYS: Make the key matching functions return bool
KEYS: Implement binary asymmetric key ID handling
PKCS#7: Clean up the signed info freeing and fix the parser cleanup
KEYS: Overhaul key identification when searching for asymmetric keys
PKCS#7: Better handling of unsupported crypto
PKCS#7: Handle PKCS#7 messages that contain no X.509 certs
PKCS#7: Allow detached data to be supplied for signature checking purposes
MODSIGN: Provide a utility to append a PKCS#7 signature to a module
MODSIGN: Use PKCS#7 messages as module signatures


crypto/asymmetric_keys/asymmetric_keys.h | 8 -
crypto/asymmetric_keys/asymmetric_type.c | 213 ++++++++++-----
crypto/asymmetric_keys/pkcs7_key_type.c | 2
crypto/asymmetric_keys/pkcs7_parser.c | 66 +++--
crypto/asymmetric_keys/pkcs7_parser.h | 7
crypto/asymmetric_keys/pkcs7_trust.c | 72 +++--
crypto/asymmetric_keys/pkcs7_verify.c | 131 +++++++--
crypto/asymmetric_keys/x509_cert_parser.c | 55 ++--
crypto/asymmetric_keys/x509_parser.h | 6
crypto/asymmetric_keys/x509_public_key.c | 102 ++++---
fs/cifs/cifs_spnego.c | 1
fs/cifs/cifsacl.c | 1
fs/nfs/idmap.c | 2
include/crypto/pkcs7.h | 3
include/crypto/public_key.h | 6
include/keys/asymmetric-type.h | 38 +++
include/keys/user-type.h | 1
include/linux/kernel.h | 1
include/linux/key-type.h | 34 ++
init/Kconfig | 1
kernel/module_signing.c | 220 +++------------
lib/hexdump.c | 18 +
net/dns_resolver/dns_key.c | 18 +
net/rxrpc/ar-key.c | 2
scripts/Makefile | 2
scripts/sign-file | 421 -----------------------------
scripts/sign-file.c | 189 +++++++++++++
security/keys/big_key.c | 2
security/keys/encrypted-keys/encrypted.c | 1
security/keys/internal.h | 10 -
security/keys/key.c | 2
security/keys/keyring.c | 59 +++-
security/keys/proc.c | 8 -
security/keys/process_keys.c | 13 -
security/keys/request_key.c | 21 +
security/keys/request_key_auth.c | 6
security/keys/trusted.c | 1
security/keys/user_defined.c | 14 -
38 files changed, 869 insertions(+), 888 deletions(-)
delete mode 100755 scripts/sign-file
create mode 100755 scripts/sign-file.c



\
 
 \ /
  Last update: 2014-09-08 18:01    [W:0.207 / U:0.984 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site